fix(repos): enforce managed identity on direct lookup

[andrei-hasna]

Follow-up to #68 after its original candidate merged before the independent review finding was posted.

Blocking defect fixed

A caller could pass a mismatched managed checkout path directly to repos worktree add / addWorktree(). getRepo(path) returned the row before applying the new managed-identity invariant, so the worktree plane created a branch and worktree from the wrong repository even while repos repo <same-path> correctly refused.

Fix

• enforce managed identity centrally on direct path and numeric-ID lookup
• translate the refusal into typed REPO_IDENTITY_MISMATCH at the worktree boundary
• prove no branch, directory, or lease is created on the supported explicit-path path

Evidence

• pre-fix same-row reproduction: repos repo <path> exit 1, then addWorktree({ repo: path }) returned CREATED
• post-fix retry: REFUSED, code REPO_IDENTITY_MISMATCH, empty worktree root, empty branch result, zero leases
• bun run typecheck: exit 0
• bun run test: 803 pass, 0 fail, 3571 assertions across 52 files
• git diff --check: exit 0
• staged and commit-range gitleaks: exit 0, no leaks found

Commit: f7d4113361c5bb77241bf1f90fffe3cdf39a54d5

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #70 @ c124509 — lens: correctness+security+gates, reviewer unresolved-account004 (1 of 1)

Independent focused verification found no blocking P0/P1 defects.

Read:

• The complete three-file diff and surrounding direct-lookup/worktree source.
• Numeric-ID and exact-path getRepo callers across CLI, server, GitHub sync/metadata, repo lifecycle, operations, and worktree lifecycle/tests.
• The rebase range-diff; f7d4113 = c124509, with the already-merged PR fix(repos): refuse managed path identity mismatches #68 commit removed.

Executor gates on the patch-identical candidate:

• bun install — exit 0 (setup only; not counted as a test gate).
• bun run typecheck — exit 0; zero diagnostics.
• bun run test — exit 0; 803 pass, 0 fail, 3,571 expectations, 52 files.
• git diff --check — exit 0.
• Staged and commit-range gitleaks scans — exit 0; no leaks found.

Independent focused checks:

• bun run typecheck — exit 0.
• Focused direct-lookup probe — exit 0; numeric ID and exact path both returned REPO_IDENTITY_MISMATCH.
• git diff --check origin/main...HEAD — exit 0.
• GitHub required Typecheck, Test & Build — SUCCESS, run 31195403273.

The reviewer did not count its own queued bun run test invocation because it was canceled behind the machine-wide slot guard; the executor's full declared gate and GitHub required CI cover the exact patch-identical candidate.

Blocking P0/P1 findings: none.

Non-blocking follow-up: add a persistent direct unit regression for the numeric-ID mismatch route. The committed worktree regression covers exact-path refusal; the numeric-ID route was verified by the focused runtime probe.